TrustScope: suggested Security & Supply Chain improvements for buzz

Hi! This is a friendly, optional set of suggestions for **block/buzz**, generated by [TrustScope](https://trustscope.neckarshore.ai) from the [OpenSSF Scorecard](https://securityscorecards.dev) (v5.5.0).

None of these are required — they are common hardening steps that tend to raise a project's supply-chain and governance signals. Take whatever is useful and ignore the rest.

### Security & Supply Chain
- **Branch Protection** — Add a branch-protection rule: require a pull request, a required status check, and dismiss-stale reviews. (Private repositories need a paid GitHub plan for branch protection.)
- **Code Review** — Require review before merge. Solo projects can satisfy this with an automated reviewer (e.g. CodeRabbit) instead of blocking human approval.
- **Vulnerabilities** — Enable CI dependency-vulnerability scanning (an `npm audit` gate plus Dependabot) and triage the open advisories.

---
_Assessed via TrustScope (https://trustscope.neckarshore.ai) — an open-source trust report by Neckarshore AI. These are suggestions, not demands._

Review the repository's GitHub settings and CI/dependency configuration against the three recommendations in the issue. Check which branch-protection, review, vulnerability-scanning, and advisory-triage changes are applicable, then confirm that the agreed controls are enabled and documented.

Written by the indexing model from the issue text.